During a penetration test, the tester discovers evidence of an active data breach unrelated to the test. According to engagement management best practices, what should the tester do FIRST?

Question

Accepted Answer

B. Stop all testing and immediately notify the client through the established escalation path. Discovering an active third-party breach during a penetration test is a critical finding that requires immediate escalation. The tester should stop relevant testing activities and notify the client through the pre-defined escalation path established in the rules of engagement so the client can invoke their incident response plan. Continuing to test or modify attacker artifacts could compromise the integrity of any subsequent forensic investigation.

During a penetration test, the tester discovers evidence of an active data breach unrelated to the test. According to engagement management best practices, what should the tester do FIRST?

Related Questions

Discussion